1. Field of the Invention
The present invention relates to an image forming apparatus implemented by a distributed control system that includes multiple CPU groups having a hierarchical structure.
2. Description of the Related Art
In controlling the printer device of an image forming apparatus that employs electrophotography, the practice is to carry out centralized control by a single CPU. However, an increase in CPU load ascribable to centralized control at a single point necessitates a higher performance CPU. Furthermore, an increase in printer-device control load is accompanied by the need to route communication cables (communication harness) from the CPU substrate to a control-load driver unit distant from the CPU, and a number of very long communication cables are required. In order to solve this problem, attention has focused on a control configuration in which each of the control modules that constitute the electrophotographic system is divided into individual sub-CPUs.
Examples in which a control system is thus constructed by dividing up the control functions of individual partial modules using a plurality of CPUs have been proposed in several fields relating to control-device products. For example, there is a system in which the functional modules of a vehicle are arranged hierarchically and undergo distributed control, and a system in which a hierarchical control structure is applied to robotic/automated devices. Further, each of these multiple sub-CPUs naturally has a communication unit so that all of them may operate together as a single system, and each CPU carries out information sharing and system control with the other CPUs through its communication unit.
In such a system that performs distributed control via a communication unit (the system will be referred to as a “distributed system” below), anomaly detection is an important issue. Anomalies in a distributed system include a physical anomaly in the communication unit per se and a logical anomaly brought about by the application software that operates each CPU. A parity check or CRC check of serial communication, for example, is known as a general technique for detecting physical anomalies. Another known technique further enhances network reliability by a specific communication protocol, such as a technique for counting the number of times errors occur in a CAN (Control Area Network) and excluding them from the network. There are many cases where these techniques for detecting physical anomalies are implemented by hardware, and they are capable of detecting anomalies accurately.
For the detection of logical anomalies, on the other hand, the techniques described below have been proposed. For example, the specification of Japanese Patent Laid-Open No. 2003-186691 proposes a controller having a master CPU, a slave CPU and a timer for supplying the master CPU and the slave CPU with a reset signal if an anomaly is detected. When the master CPU itself is normal, it outputs a timer-clearing signal to the timer at fixed time intervals. Specifically, if an anomaly occurs in the master CPU, the master CPU will not output the signal that clears the timer and the timer will time out. As a consequence, the master CPU and the slave CPU will be supplied with the reset signal. Further, the master CPU monitors data that is output from the slave CPU and, if it determines from this data that the slave CPU has developed an anomaly, the master CPU forcibly supplies the slave CPU with a forced reset signal. Further, the specification of Japanese Patent Laid-Open No. 2004-220562 proposes a device having a device monitoring function for monitoring another device different from its own and notifying a device management server or the other device of the result of monitoring.
The specification of Japanese Patent Laid-Open No. 2005-031865 proposes an electronic control apparatus separately provided with a monitoring control circuit for monitoring anomalies. The monitoring control circuit successively transmits a number of inquiries by inquiry packets to a microprocessor that controls a group of electrical loads in response to the content of a non-volatile program memory and the operating status of an input sensor group, and makes an anomaly determination by comparing the content of a response from the microprocessor against right-answer information. The microprocessor analyzes the intervals at which it receives the inquiry packets and thus reverse-monitors the monitoring operation of the monitoring control circuit.
However, applying these conventional techniques to a distributed system results in certain problems. For example, with the method of clearing the timer from the master CPU, it is difficult for the master CPU to detect an anomaly if one should occur in the slave CPU. This makes it difficult to realize optimum anomaly processing control in a slave CPU. Further, in the case of Japanese Patent Laid-Open No. 2004-220562, anomaly information can only be received by the node that detected it and by separate nodes that have been so notified, and it is difficult for nodes other than these to ascertain the anomaly. Furthermore, if the control load of the monitoring node increases, this will result in a decline in the frequency of execution of anomaly detection control, which generally has a lower execution priority that that of load control. This lengthens the time from occurrence of an anomaly to the detection thereof. Further, in a case where a monitoring control circuit or a node dedicated to anomaly detection is provided, as in Japanese Patent Laid-Open No. 2005-031865, higher cost is inevitable.